Using Sigma

To put it simple, Sigma rules are the YARA rules of log files created by Florian Roth (https://github.com/Neo23x0/sigma). It’s an open signature format that can be applied to any log file and that can be used to describe and share detections.

Since the first presentation in 2007, Sigma has been widely adopted by the cybersecurity community and can be converted to many SIEMs formats. If you are not familiar with SIEMS, you probably are not aware that each vendor will use its own proprietary format. Add this to the already mentioned differences between data sources and you’ll realize that having a common language to share detections is something pretty useful that came to solve lots of problems.

But how do this work? First we create the Sigma rule file, which is a generic YAML-based formatted file. Then, after we finished filling all the information for the rule, we convert the file in two different ways: one would be the specific formatting needed for our SIEM...